tor-browser

commit d5db0cc63b58fa9a476f12cbe0244eb4bcb22bf9
parent 84d91075904f789517a20b252068295bc86cb5fb
Author: Rong "Mantle" Bao <webmaster@csmantle.top>
Date:   Tue,  6 Jan 2026 14:49:13 +0000

Bug 2007682 - Check dest register for -0 in {riscv64,loong64,mips64} ma_mod_mask. r=spidermonkey-reviewers,jandem

Differential Revision: https://phabricator.services.mozilla.com/D277512

Diffstat:
A
js/src/jit-test/tests/bug2007682.js
 | 
16
++++++++++++++++
M
js/src/jit/loong64/MacroAssembler-loong64.cpp
 | 
10
++++------
M
js/src/jit/mips-shared/MacroAssembler-mips-shared.cpp
 | 
10
++++------
M
js/src/jit/riscv64/MacroAssembler-riscv64.cpp
 | 
10
++++------

4 files changed, 28 insertions(+), 18 deletions(-)
diff --git a/js/src/jit-test/tests/bug2007682.js b/js/src/jit-test/tests/bug2007682.js
@@ -0,0 +1,16 @@
+// |jit-test| --no-threads; --fast-warmup
+
+function g(x) {
+  return x % 7;
+}
+function f() {
+  with ({}) {} // Don't compile with Ion.
+  for (var i = 0; i < 500; i++) {
+    if (i < 450) {
+      g(1);
+    } else {
+      assertEq(g(-7), -0);
+    }
+  }
+}
+f();
diff --git a/js/src/jit/loong64/MacroAssembler-loong64.cpp b/js/src/jit/loong64/MacroAssembler-loong64.cpp
@@ -1691,15 +1691,13 @@ void MacroAssemblerLOONG64::ma_mod_mask(Register src, Register dest,
   // Check the hold to see if we need to negate the result.
   ma_b(hold, hold, &done, NotSigned, ShortJump);
 
-  // If the hold was non-zero, negate the result to be in line with
-  // what JS wants
   if (negZero != nullptr) {
     // Jump out in case of negative zero.
-    ma_b(hold, hold, negZero, Zero);
-    as_sub_w(dest, zero, dest);
-  } else {
-    as_sub_w(dest, zero, dest);
+    ma_b(dest, dest, negZero, Zero);
   }
+  // If the hold was non-zero, negate the result to be in line with
+  // what JS wants
+  as_sub_w(dest, zero, dest);
 
   bind(&done);
 }
diff --git a/js/src/jit/mips-shared/MacroAssembler-mips-shared.cpp b/js/src/jit/mips-shared/MacroAssembler-mips-shared.cpp
@@ -461,15 +461,13 @@ void MacroAssemblerMIPSShared::ma_mod_mask(Register src, Register dest,
   // Check the hold to see if we need to negate the result.
   ma_b(hold, hold, &done, NotSigned, ShortJump);
 
-  // If the hold was non-zero, negate the result to be in line with
-  // what JS wants
   if (negZero != nullptr) {
     // Jump out in case of negative zero.
-    ma_b(hold, hold, negZero, Zero);
-    ma_negu(dest, dest);
-  } else {
-    ma_negu(dest, dest);
+    ma_b(dest, dest, negZero, Zero);
   }
+  // If the hold was non-zero, negate the result to be in line with
+  // what JS wants
+  ma_negu(dest, dest);
 
   bind(&done);
 }
diff --git a/js/src/jit/riscv64/MacroAssembler-riscv64.cpp b/js/src/jit/riscv64/MacroAssembler-riscv64.cpp
@@ -6626,15 +6626,13 @@ void MacroAssemblerRiscv64::ma_mod_mask(Register src, Register dest,
   // Check the hold to see if we need to negate the result.
   ma_b(hold, hold, &done, NotSigned, ShortJump);
 
-  // If the hold was non-zero, negate the result to be in line with
-  // what JS wants
   if (negZero != nullptr) {
     // Jump out in case of negative zero.
-    ma_b(hold, hold, negZero, Zero);
-    negw(dest, dest);
-  } else {
-    negw(dest, dest);
+    ma_b(dest, dest, negZero, Zero);
   }
+  // If the hold was non-zero, negate the result to be in line with
+  // what JS wants
+  negw(dest, dest);
 
   bind(&done);
 }